bz19983: handle bad XML charrefs without crashing